Extra security for GraphiQL #3168
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Thanks for your contribution! Depending on what you are working on, you may want to request a review from a Shopify team:
|
Coverage report
Show files with reduced coverage 🔻
Test suite run success1494 tests passing in 670 suites. Report generated by 🧪jest coverage report action from 306c0f6 |
amcaplan
force-pushed
the
securer-graphiql
branch
from
0009127
to
f53c37f
Compare
amcaplan
force-pushed
the
securer-graphiql
branch
from
f53c37f
to
306c0f6
Compare
shauns
approved these changes
Dec 5, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
WHY are these changes introduced?
There's some potential for damage via the not-quite-yet-released GraphiQL. If someone guesses your Cloudflare tunnel URL, they can find GraphiQL and start causing trouble on your dev store. (Not your prod store, of course, as you can't
devon those.)WHAT is this pull request doing?
Adds a measure of security. Generates a 16-byte random key during startup, and requires that key for accessing GraphiQL.
The frontend UI and operation execution endpoints are the most in need of security.
How to test your changes?
Run GraphiQL. Change the key in the URL and see that it fails.
You can also open the network tab, copy a request as CURL, and see it succeeds. Then change the key and observe it fail.
Measuring impact
How do we know this change was effective? Please choose one:
Checklist
devordeployhave been reflected in the internal flowchart.